Suspicious ^80% Download

Trojan-Banker.Win32.Banker.gwg

Banker trojan with encoded URLs

Detects an XORed URL in an executableEncoded content decoded: xor

SHA-256af79512dad693e0394de57770a86adac75ca5bf0f68f52ce51d928110df9038c

MaleculeMdTh

Evidence

Encoded content decoded: xor 0x1fb8–0x2148

⋯3 more rows
0x1fe879642a3574747a397264353763782a35yd*5ttz9rd57cx*5
0x1ff87f6363672d3838606060396370747574.ccg-88```9cptut
0x20087639786570387e7a7670726438643874v9xep8~zvprd8d8t
⋯8 more rows
0x209876657e7835292b387379647a76647c29ve~x5)+8sydzvd|)
0x20a81a1d2b7379647a76647c377379642a35..+sydzvd|7syd*5
0x20b874767a397264353763782a357f636367tvz9rd57cx*5.ccg
0x20c82d383860606039637074757476397865-88```9cptutv9xe
0x20d870387e7a7670726438643874767a7264p8~zvprd8d8tvzrd
⋯7 more rows

Detects an XORed URL in an executable 0x31f2–0x32b2

⋯3 more rows
0x3222797c78763972643537637862657b2a35y|xv9rd57cxbe{*5
0x32327f636367642d38387576797c78767972.ccgd-88uvy|xvyr
0x3242633974787a35292b38657273291a1d1ac9txz5)+8ers)...
⋯7 more rows

Percent-encoded content decoded 0x469b–0x47cb

⋯3 more rows
0x46cb722a63726f63377a766f5b727970637fr*croc7zvo[rypc.
0x46db2a2537647e6d722a253761767b62722a*%7d~mr*%7av{br*
0x46eb30303779767a722a7e797d7274635976007yvzr*~y}rtcYv
0x46fb7e6464767974725d5d29381a1d2b5e59~ddvytr]])8..+^Y
0x470b474243376376755e7973726f2a233763GBC7cvu^ysro*#7c
0x471b6e67722a63726f63377a766f5b727970ngr*croc7zvo[ryp
0x472b637f2a2537647e6d722a253761767b62c.*%7d~mr*%7av{b
0x473b722a30303779767a722a7e797d727463r*007yvzr*~y}rtc
0x474b59767e6464767974725a5a29381a1d2bYv~ddvytrZZ)8..+
0x475b5e59474243376376755e7973726f2a22^YGBC7cvu^ysro*"
⋯7 more rows